The lock-lab Key Vault is gone, but an encrypted Key Vault backup blob remains. How should the security engineer recover the objects?
Select an answer to reveal the explanation.
Short Explanation
That backup blob isn’t a diary—you can’t open it as plaintext. Restore it into a Key Vault that sits inside the geography and subscription rules Microsoft documents for restore.
Full Explanation
An encrypted Key Vault backup blob is not cleartext key export. Recovery means restoring that blob into a Key Vault that meets the same geography and subscription constraints Microsoft documents for the backup format. When the lock-lab vault is gone but the blob remains, create or select a compliant destination vault and restore the objects there; do not attempt to read the blob as plaintext.
Opening the backup blob in Notepad and pasting key material into a new vault fails by concept—the blob is encrypted and not a diary of key bytes. Uploading the blob to a public Git repository fails confidentiality and still does not make the contents human-readable keys. Converting the backup into an NSG rule set fails entirely: network rules do not recreate cryptographic objects.
Exam caveat: soft-delete recover applies when the vault still exists; backup restore is the path for vault loss or post-retention scenarios within restore rules. Operational check: provision a destination Key Vault in an allowed geography/subscription, restore the encrypted blob, verify keys/secrets/certificates appear, re-point CMK dependents if names/identifiers require update, and lock down who can download backup blobs.